fix: skip CSRF protection for feedback form submission#2641
Merged
Conversation
The feedback form uses a unique secret token in the URL to authenticate the request. This is sufficient protection against CSRF — an attacker would need to know the token to submit the form. However, protect_from_forgery requires a session cookie, which browsers like Safari withhold when they classify the request as cross-site (e.g. when a user navigates from a third-party app or Intelligent Tracking Prevention is active). This causes the form submission to fail with ActionController::InvalidAuthenticityToken even for legitimate users. This has caused 82 occurrences in production (Rollbar #535). Changes: - Skip CSRF protection on FeedbackController#submit - Add controller specs covering show, submit, and the CSRF-exempt path Fixes: https://app.rollbar.com/a/codebar-production/fix/item/codebar-production/535#detail
olleolleolle
approved these changes
Jun 11, 2026
olleolleolle
left a comment
olleolleolle
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for giving good context to the fix!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
We are seeing
ActionController::InvalidAuthenticityTokenerrors when students try to submit feedback. This has occurred 82 times in production (Rollbar #535).The root cause is that the feedback form requires a session cookie for CSRF protection, but browsers like Safari withhold the session cookie when they classify the request as cross-site. This happens when:
Sec-Fetch-Site: cross-siteWhy the fix is safe
The feedback form already has its own security mechanism: a unique, unguessable secret token in the URL (e.g.
/feedback/QecUjt60K2J94mBc169Myw/submit). TheFeedbackRequestis looked up by this token. An attacker would need to know the token to submit the form, which is exactly the same bar as CSRF protection.This is the standard "one-time secret link" pattern — the token itself is sufficient to prevent CSRF.
Changes
skip_forgery_protection only: :submitinFeedbackControllerRollbar issue
https://app.rollbar.com/a/codebar-production/fix/item/codebar-production/535#detail